---
title: Safely running AI generated code in your Next.js application
description: How to execute untrusted, AI‑generated code from a Next.js app using Vercel Sandbox, an isolated, ephemeral environment.
url: /kb/guide/running-ai-generated-code-sandbox
canonical_url: "https://vercel.com/kb/guide/running-ai-generated-code-sandbox"
published: 2025-11-03
last_updated: 2026-06-17
authors: Delba de Oliveira
related:
  - /docs/vercel-sandbox
  - /docs/ai-gateway
  - /docs/cli
  - /docs/vercel-sandbox/sdk-reference
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---
<!-- docsgraph:related -->
## Related pages

> **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below.

- [Examples](https://vercel.com/docs/sandbox/working-with-sandbox?from=related) — Task-oriented examples for common Vercel Sandbox operations in TypeScript and Python.
- [OpenAI SDK](https://vercel.com/docs/sandbox/ecosystem/openai-sdk?from=related) — Use OpenAI function calling with AI Gateway to execute model-generated code in an isolated Vercel Sandbox.
- [Anthropic SDK](https://vercel.com/docs/sandbox/ecosystem/anthropic-sdk?from=related) — Use Anthropic tool use with AI Gateway to execute model-generated code in an isolated Vercel Sandbox.
- [LangChain](https://vercel.com/docs/sandbox/ecosystem/langchain?from=related) — Give a LangChain agent a tool that executes model-generated code in an isolated Vercel Sandbox, with models served by AI
- [Sandbox](https://vercel.com/docs/sandbox?from=related) — Vercel Sandbox allows you to run arbitrary code in isolated, ephemeral Linux VMs.
- [How to execute AI-generated code safely with Vercel Sandbox](https://vercel.com/kb/guide/how-to-execute-ai-generated-code-safely?from=related) — Learn how to run code generated by AI models in an isolated sandbox environment.
- [Run Python code securely with AI SDK and Vercel Sandbox](https://vercel.com/kb/guide/python-ai-sdk-vercel-sandbox?from=related) — Add an \`executeCode\` tool to your AI SDK agent with the \`ai-sdk-tool-code-execution\` package to run Python 3.13 insi
- [How to build a durable AI code agent on Vercel](https://vercel.com/kb/guide/how-to-build-a-durable-ai-code-agent-on-vercel?from=related) — Build an AI agent that generates code, writes its own tests, and executes them in an isolated microVM with automatic ret

Full cross-link map for this page: [/kb/guide/running-ai-generated-code-sandbox.graph.md](/kb/guide/running-ai-generated-code-sandbox.graph.md)
<!-- /docsgraph:related -->


AI models are increasingly used to generate code. Often, applications return this code to the user as plain text. But some apps could run the generated code to produce UI or other results.

This creates powerful possibilities but introduces risk. Generated code is untrusted. It may delete files, leak sensitive data, or consume excessive resources. The danger increases when users can influence prompts and craft malicious input. So running AI generated code on your machine or in your production application is unsafe.

[Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) addresses this by running untrusted code in a remote, isolated environment with strong safeguards and full control.

## Overview

In this guide, you'll learn:

- What Vercel Sandbox is and how it works.
  
- How to create a sandbox, run commands, and capture results.
  
- Example: Use an AI SDK Agent to generate and safely execute code inside a sandbox.
  

## Example

To understand how Vercel Sandbox works, let's build a minimal AI app that responds to natural language queries that require computation or network access, such as: "Get the top story from Hacker News” or "What is 44 × 44?"

To keep the example simple and avoid boilerplate code, we'll use the following tools:

- A Next.js [route handler](https://nextjs.org/docs/app/getting-started/route-handlers-and-middleware) that accepts user input and returns the result.
  
- The [AI Gateway](https://vercel.com/docs/ai-gateway) to query OpenAI without managing API keys.
  
- The [AI SDK](https://ai-sdk.dev/) to create an agent that orchestrates tool calls and sandbox execution.
  
- [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) to run the generated code.
  

Here's how it works:

Since the generated code and packages are unpredictable and potentially unsafe, we will run and install them inside Vercel Sandbox.

### 1\. Initial setup

Create a minimal Next.js project:

```bash
pnpx create-next-app sandbox-example --api
```

Install required packages:

```bash
pnpm add @vercel/sandbox ai zod
```

### 2\. Authenticate with Vercel

- **Prerequisite**: Install the [Vercel CLI.](https://vercel.com/docs/cli)
  

Vercel Sandbox and AI Gateway use [Vercel OIDC tokens](https://vercel.com/docs/vercel-sandbox#vercel-oidc-token) to authenticate whenever available. This is the most straightforward and recommended way to authenticate. You can also authenticate using [access tokens](https://vercel.com/docs/vercel-sandbox#using-access-tokens).

Link local directory to Vercel project:

```bash
vercel link
```

Pull OIDC token for local development:

```bash
vercel env pull
```

In development, the token expires after 12 hours (run vercel env pull again to refresh). In production, Vercel manages token expiration for you.

### 3\. Create a Route Handler

Finally, we'll set up a Next.js route handler that accepts a request, generates and runs code and returns a response to the user.

```typescript
import { NextRequest, after } from "next/server"
import { Sandbox } from "@vercel/sandbox"
import { Experimental_Agent as Agent, stepCountIs, tool } from "ai"
import { z } from "zod"

export async function POST(req: NextRequest) {
  let sandbox: Sandbox | null = null

  const body = await req.json()
  const parsed = z
    .object({ prompt: z.string().min(1).max(10_000) })
    .safeParse(body)
  if (!parsed.success) {
    return Response.json(
      { error: "Invalid body. Expected { prompt: string }." },
      { status: 400 },
    )
  }
  const { prompt } = parsed.data

  // create an isolated VM
  sandbox = await Sandbox.create({
    runtime: "node22",
    // stop sandbox after 30 seconds of inactivity
    timeout: 30_000,
  })
  console.log(`[agent] sandbox ${sandbox.sandboxId} created`)

  const agent = new Agent({
    model: "openai/gpt-5-nano",
    system:
      "You are an AI assistant that generates and runs JS. Use console.log to output values.",
    tools: {
      generateAndRunCode: tool({
        description: "Use this tool to run JS code in Node.js v22 sandbox",
        inputSchema: z.object({
          code: z.string().describe("The JS code to run"),
          packages: z
            .array(z.string())
            .nullable()
            .default([])
            .describe("Optional packages to install"),
        }),
        execute: async ({ code, packages }) => {
          // If the LLM output provides packages, install them with npm.
          if (packages && packages.length > 0) {
            console.log(`[agent] npm install ${packages.join(" ")}`)
            const installStep = await sandbox.runCommand({
              cmd: "npm",
              args: ["install", ...packages],
            })
            const installOut = await installStep.stdout()
            console.log(`[agent] npm install exit=${installStep.exitCode}`)
            if (installStep.exitCode !== 0) {
              return { output: installOut, exitCode: installStep.exitCode }
            }
          }
          console.log(`[agent] generated code:\n${code}`)
          console.log(`[agent] node -e (code length=${code.length})`)
          // Execute generated code, e.g. node -e "console.log('Hello, world!')"
          const runResult = await sandbox.runCommand({
            cmd: "node",
            args: ["-e", code],
          })
          const output = await runResult.stdout()
          console.log(`[agent] node exit=${runResult.exitCode}`)
          return { output, exitCode: runResult.exitCode }
        },
      }),
    },
    stopWhen: stepCountIs(10),
  })

  console.log(`[agent] generate start`)
  const result = await agent.generate({ prompt })
  console.log(`[agent] generate done (text=${result.text.length} chars)`)

  after(async () => {
    // cleanup sandbox after request is done
    await sandbox.stop()
  })
  return Response.json({ text: result.text })
}
```

### 4\. Test with a prompt

We can now test our application using a prompt. Start the Next.js development server by running `pnpm run dev,` then in a new terminal window, send a user query using `cURL`:

```bash
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Get Hacker News top story title and URL"}' \
  http://localhost:3000/api/agent | jq .
```

You can switch to the development server terminal to observe the program running. Finally, once done, you can switch back to the other terminal to see the result. You should see a message that includes the title and url of a hackernews post.

### 5\. Verify isolation with safe "harmful" prompts

You can also see the benefit of running the generated code in a sandbox by intentionally sending destructive and malicious queries to your application.

Attempt to delete files:

```bash
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Delete the ./tmp folder and show me the result"}' \
  http://localhost:3000/api/agent | jq .
```

_Expectation: The folder (if it exists) is removed inside the sandbox, but your main application files are unchanged._

Attempt to read secrets:

```bash
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Print process.env"}' \
  http://localhost:3000/api/agent | jq .
```

_Expectation: You only see environment variables of the sandbox and not the host environment._

## Next steps

This example showed how to combine Next.js, the AI SDK, and Vercel Sandbox to safely run generated code. Learn more in the [Vercel Sandbox docs](https://vercel.com/docs/vercel-sandbox) and [SDK reference](https://vercel.com/docs/vercel-sandbox/sdk-reference) and try it out in your own project today.